In one of my projects, we created a new GuestUser that implements a Sylius\Component\User\Model\UserInterface. When I tried to access an invoice with that user, the Sylius\InvoicingPlugin\Security\Voter\InvoiceVoter denied access, because it only handles AdminUserInterface and ShopUserInterface. The AdminUserInterface check seems fine, but perhaps we can consider to loosen the ShopUserInterface type check to something like a type check for Sylius\Component\Customer\Model\CustomerAwareInterface as the Customer is the only data we need in that place?
In one of my projects, we created a new
GuestUser
that implements aSylius\Component\User\Model\UserInterface
. When I tried to access an invoice with that user, theSylius\InvoicingPlugin\Security\Voter\InvoiceVoter
denied access, because it only handlesAdminUserInterface
andShopUserInterface
. TheAdminUserInterface
check seems fine, but perhaps we can consider to loosen theShopUserInterface
type check to something like a type check forSylius\Component\Customer\Model\CustomerAwareInterface
as the Customer is the only data we need in that place?What do you think?